feat: parliament daemon, login gate, peer context sync (0.9.13)

Login claims the chair, writes a session ticket, and starts a background
service for discovery plus revision-based context sync. Password Realm
opens require --login (or CST_REALM_PASSWORD); --service/--service-stop
manage the resident agent.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/parliament_cli.c

@@ -69,6 +69,13 @@ int cst_parliament_cli_realm_password_init(const char *password) {
 
 int cst_parliament_cli_login(const char *password, const char *instance_id,
                              const char *device_label) {
+  return cst_parliament_cli_login_and_serve(password, instance_id, device_label,
+                                            9100);
+}
+
+int cst_parliament_cli_login_and_serve(const char *password,
+                                       const char *instance_id,
+                                       const char *device_label, int peer_port) {
   char err[256];
   char *hand = cst_parliament_login(password, instance_id, device_label, err,
                                     sizeof(err));
@@ -78,6 +85,49 @@ int cst_parliament_cli_login(const char *password, const char *instance_id,
   }
   fputs(hand, stdout);
   free(hand);
+  if (cst_parliament_daemon_start(password, instance_id,
+                                  peer_port > 0 ? peer_port : 9100, err,
+                                  sizeof(err)) != 0) {
+    fprintf(stderr, "service: %s\n", err[0] ? err : "start failed");
+    return 1;
+  }
+  if (cst_parliament_daemon_running())
+    printf("service=running\n");
+  return 0;
+}
+
+int cst_parliament_cli_service(const char *password, const char *instance_id,
+                               int peer_port, int foreground) {
+  char err[256];
+  if (!instance_id || !instance_id[0]) {
+    fprintf(stderr, "instance id required\n");
+    return 1;
+  }
+  if (foreground) {
+    if (cst_parliament_daemon_run(password, instance_id,
+                                  peer_port > 0 ? peer_port : 9100, err,
+                                  sizeof(err)) != 0) {
+      fprintf(stderr, "%s\n", err[0] ? err : "service failed");
+      return 1;
+    }
+    return 0;
+  }
+  if (cst_parliament_daemon_start(password, instance_id,
+                                  peer_port > 0 ? peer_port : 9100, err,
+                                  sizeof(err)) != 0) {
+    fprintf(stderr, "%s\n", err[0] ? err : "service start failed");
+    return 1;
+  }
+  printf("service=running\n");
+  return 0;
+}
+
+int cst_parliament_cli_service_stop(void) {
+  if (cst_parliament_daemon_stop() != 0) {
+    fprintf(stderr, "service stop failed\n");
+    return 1;
+  }
+  printf("service=stopped\n");
   return 0;
 }
 
@@ -116,6 +166,19 @@ int cst_parliament_cli_realm_enroll(const char *instance_id, const char *label)
   return 0;
 }
 
+static int load_realm_for_cli(cst_realm_keys_t *realm) {
+  char dir[OS_PATH_MAX];
+  if (cst_realm_dir(dir, sizeof(dir)) != 0)
+    return -1;
+  if (cst_realm_is_password_mode(dir)) {
+    const char *pw = getenv("CST_REALM_PASSWORD");
+    if (!pw || !pw[0])
+      return -1;
+    return cst_realm_unlock_password(dir, pw, realm);
+  }
+  return cst_realm_load(dir, realm);
+}
+
 int cst_parliament_cli_peer_listen(int port, const char *instance_id) {
   if (!instance_id || !instance_id[0]) {
     fprintf(stderr, "instance id required\n");
@@ -125,7 +188,7 @@ int cst_parliament_cli_peer_listen(int port, const char *instance_id) {
   cst_realm_keys_t realm;
   cst_realm_cert_t cert;
   uint8_t sk[64];
-  if (cst_realm_dir(dir, sizeof(dir)) != 0 || cst_realm_load(dir, &realm) != 0 ||
+  if (cst_realm_dir(dir, sizeof(dir)) != 0 || load_realm_for_cli(&realm) != 0 ||
       cst_realm_instance_load(instance_id, &cert, sk) != 0) {
     fprintf(stderr, "cannot load realm/instance %s\n", instance_id);
     return 1;
@@ -151,6 +214,7 @@ int cst_parliament_cli_peer_listen(int port, const char *instance_id) {
     return 1;
   }
   printf("peer_ok remote=%s host=%s\n", sess.remote.instance_id, sess.host);
+  cst_peer_close(&sess);
   os_net_close(ls);
   return 0;
 }
@@ -165,7 +229,7 @@ int cst_parliament_cli_peer_dial(const char *host, int port,
   cst_realm_keys_t realm;
   cst_realm_cert_t cert;
   uint8_t sk[64];
-  if (cst_realm_dir(dir, sizeof(dir)) != 0 || cst_realm_load(dir, &realm) != 0 ||
+  if (cst_realm_dir(dir, sizeof(dir)) != 0 || load_realm_for_cli(&realm) != 0 ||
       cst_realm_instance_load(instance_id, &cert, sk) != 0) {
     fprintf(stderr, "cannot load realm/instance %s\n", instance_id);
     return 1;
@@ -177,6 +241,7 @@ int cst_parliament_cli_peer_dial(const char *host, int port,
     return 1;
   }
   printf("peer_ok remote=%s\n", sess.remote.instance_id);
+  cst_peer_close(&sess);
   return 0;
 }
 
@@ -188,7 +253,7 @@ int cst_parliament_cli_discover(const char *instance_id, int peer_port,
   }
   char dir[OS_PATH_MAX], fp[33];
   cst_realm_keys_t realm;
-  if (cst_realm_dir(dir, sizeof(dir)) != 0 || cst_realm_load(dir, &realm) != 0 ||
+  if (cst_realm_dir(dir, sizeof(dir)) != 0 || load_realm_for_cli(&realm) != 0 ||
       cst_realm_fingerprint(realm.pk, fp) != 0) {
     fprintf(stderr, "cannot load realm\n");
     return 1;